MetaEncryptor Ransomware Decryption & Data Recovery

BleepingComputer dates the MetaEncryptor leak site to August 2022; it accumulated twelve victims through July 2023 and then went quiet. In September 2023 a new brand, LostTrust, appeared using the exact same site template and bio, and its encryptor carried a METAENCRYPTING string. Researchers Stefano Favarato and MalwareHunterTeam concluded LostTrust was a MetaEncryptor rebrand, with both derived from the SFile2 encryptor. The publicly documented lineage runs SFile (February 2020) to SFile2 to MetaEncryptor (from August 2022) to LostTrust (from September 2023). Note that leak-site trackers date the group's first appearance to mid-2023: that is when those platforms began scraping the site - the first twelve victim records all carry the same 2023-08-16 capture date - and it is not the same thing as when the site went live.

Unlike the usual rebrand script, the original site was never retired. Posting continued after September 2023 and through 2024 - five victims went up on 7 May 2024, around nine across that year - then thinned to roughly quarterly entries in 2025, before six records appeared on 23 August 2026 and four more on 7 September 2026. Both batches need care. One of those organisations had already been captured by a different tracker in March 2026, and another record carries a post date of November 2025, so the clustered dates look like backfill after a tracker resumed scraping rather than same-day new attacks. ransomware.live holds 42 entries as of 2026-09-11, concentrated in the US, Germany and Canada, across manufacturing, automotive and transport, professional services and education, with Japanese and Singaporean organisations in the latest batches.

Every entry is a unilateral claim with limited third-party confirmation. One US medical device maker named in September 2026 had already been listed by a different ransomware brand that June and was facing a class action over it, so re-listing of older data cannot be ruled out. This page therefore does not enumerate victim names and does not treat leak-site posts as established fact.

Public information is limited. As of 2026-09-11 no major vendor or CERT has published a sample analysis or IOC set for a MetaEncryptor-branded encryptor, and no Chinese vendor has issued a report on this brand - although the Chinese vendor Rising did document a Linux variant of the upstream SFile branch in late 2021. The operators describe themselves on the site as "a group of young people who identify themselves as specialists in the field of network security with at least 15 years of experience", say the work is purely commercial and deny any link to politics or intelligence services. The same site template states that every incident is notified to all possible press in the region - a line Sophos recorded on the LostTrust site in its December 2023 research on ransomware crews and the media. Media pressure is their main lever. No public record places the MetaEncryptor brand against mainland China organisations, but the Linux and FreeBSD variants of the upstream SFile branch were aimed mainly at Chinese targets, and overseas subsidiaries of Chinese groups sit inside the same target space.

MetaEncryptor has no publicly documented extension or ransom note filename, so extension matching cannot identify it. Attribution currently rests on the extortion side:

• The organisation appears in a post on the MetaEncryptor leak site (public trackers record two .onion mirrors), with a claimed data volume and a sample pack.
• Contact is directed to a Tox ID published on the site rather than to email.
• The site's language stresses the operators' "security specialist" identity, denies political ties, and threatens to notify regional press and seed the data on leak forums.

Related-family artefacts are a comparison reference, not a substitute. The LostTrust rebrand used the .losttrustencoded extension and a !LostTrustEncoded.txt note; earlier SFile2 builds used .sfile2 or .sfile3 with !!FILES_ENCRYPTED.txt. If your files match one of those, they point at that branch, not at the current MetaEncryptor brand.

Preserve three to five encrypted samples, the original note and the surrounding logs, and confirm family and build by reverse engineering and sample comparison. Do not assume network-wide encryption just because a company name shows up on a leak site, and do not self-attribute from a headline - misattribution leads straight to the wrong recovery plan.

No authoritative report documents MetaEncryptor's full access and lateral movement chain. One verifiable thread comes from HiSolutions' research on CSHARP-STREAMER: a memory-only modular .NET RAT with TCP relay pivoting, PowerShell execution, domain user enumeration and AMSI bypass, observed across intrusions attributed to several crews. The researchers tie its use to the rise in Metaencryptor and LostTrust victim postings from August 2023 and suggest an initial access broker distributes access to multiple ransomware groups - meaning the entry point is likely bought rather than built.

The related SFile and LostTrust branches are publicly recorded as arriving through internet-exposed RDP without MFA and phishing emails with malicious attachments. Combined with the victim profile (mid-to-large manufacturing, professional services, transport and healthcare), treat the list below as a triage priority rather than a confirmed kill chain:

• Remote access without MFA (VPN, RDP, jump hosts) and known vulnerabilities in edge appliances.
• Credentials from infostealer logs and resold initial access.
• Traces of memory-resident RATs and abuse of legitimate remote administration tooling - process injection, anomalous PowerShell, internal relay connections.
• Credential spread across the domain and reachability of backup systems and hypervisor management interfaces.

No public reverse-engineering of a MetaEncryptor encryptor exists. What follows is documented behaviour of the related SFile2 and LostTrust branches - expected behaviour to test against, not confirmed fact for the current brand:

• A combination of symmetric and asymmetric algorithms encrypts file content, with no key material left in cleartext.
• Targets include documents, databases, images, audio and video, disk images and archives.
• System logs are cleared, volume shadow copies deleted and database and security-related processes stopped, closing off local rollback.
• The note pressures victims with publication of the data if no contact is made within a deadline - classic steal-then-encrypt double extortion.

Whether encryption is intermittent is unknown. No public data says whether only part of each file is overwritten. That single question decides whether large files - databases, virtual disks, mail stores - retain space for structural repair, so the overwritten regions and their proportion must be measured on the real files during forensics rather than assumed from other families.

Platform. Public samples of the MetaEncryptor brand are Windows PE, and no Linux or ESXi encryptor has been publicly confirmed for it. The lineage as a whole is not Windows-only, though: the upstream SFile (Escal) branch gained Linux and FreeBSD variants in late 2021 - documented by the Chinese vendor Rising and by ESET, and confirmed by MalwareHunterTeam - aimed mainly at organisations in China. So do not assume non-Windows hosts are safe: if virtualisation or Linux servers are also affected, establish forensically whether an encryptor ran or the virtual disks were damaged at the host layer.